GOG Sync

PassAudited by ClawScan on May 12, 2026.

Overview

GOG Sync appears to do what it says, but running it can copy local GOG saves and config files to an rsync/SSH remote, so the destination should be checked first.

Before installing, inspect the small sync.sh script, replace or configure the user@remote destinations, and make sure rsync and a trusted gogrepo tool are installed. Treat saves and config files as personal data and only sync them to a remote host you control.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI02: Tool Misuse and Exploitation

What this means

If run, the skill can upload local game save data to the configured remote host.

Why it was flagged

The sync and sync-saves commands recursively copy local save files to a remote rsync destination. This is purpose-aligned for backup/sync, but it is an off-device transfer users should intentionally configure.

Skill content

rsync -av ~/Games/GOG/saves/ user@remote:/backups/gog/saves/

Recommendation

Verify or edit the rsync destination before running sync or sync-saves, and run the commands only when you intend to back up those files.

Note

ASI03: Identity and Privilege Abuse

What this means

The skill may use your existing SSH/remote-host access to write backup files.

Why it was flagged

A user@host rsync destination normally uses the user's remote account or SSH credentials. This is expected for remote backup, but the registry declares no primary credential, so users should notice the implicit account access.

Skill content

`GOG_CONFIG_REMOTE` — remote rsync destination (default: `user@remote:/backups/gog/config`)

Recommendation

Use a dedicated backup account or restricted remote path where possible, and confirm which SSH identity rsync will use.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Full library sync may fail or use whatever gogrepo-compatible binary is installed on the system.

Why it was flagged

The metadata requires rsync, the script invokes gogrepo for full library sync, and skill.json lists gogrepoc, which appears inconsistent. There is no install spec, so users must supply trusted external tools themselves.

Skill content

"dependencies": ["gogrepoc", "rsync"]

Recommendation

Install rsync and a trusted gogrepo tool manually, and verify the dependency name before relying on full library sync.